Armaxis chains an IDOR in the password-reset flow to seize the admin account, then abuses a markdown image parser that shells out to an unquoted curl for OS command injection — a single injected cat reads the flag, where the author’s intended route uses curl’s file:// LFI.
OnlyHacks is a dating-app web challenge where a suspiciously chatty match renders raw HTML in her DMs — a stored XSS payload steals her session cookie, and swapping it in hands over her inbox and the flag.
Your manager has just informed you that, due to recent budget cuts, you’ll need to take on additional responsibilities in threat analysis. As a junior threat intelligence analyst at a cybersecurity firm, you’re now tasked with investigating a cyber espionage campaign linked to a group known as Salt Typhoon. Apparently, defending against sophisticated Nation-State cyber threats is now a “do more with less” kind of game. Your Task: Conduct comprehensive research on Salt Typhoon, focusing on their tactics, techniques, and procedures. Utilize the MITRE ATT&CK framework to map out their activities and provide actionable insights. Your findings could play a pivotal role in fortifying our defenses against this adversary. Dive deep into the data and show that even with a shoestring budget, you can outsmart the cyber baddies.